Jurisdiction Coverage Map

Consenti ships an embedded map of 211 countries and territories, each pre-assigned to one of the 8 built-in compliance groups — the model that decides opt-in vs. opt-out behaviour, GPC handling, and legitimate-interest rules. It's the reference for the type field in UI / Backend configuration, and for the compliance array shown on every compliance guide.

Compliance Tiers

Every named regulation guide carries a status badge — Maintained, Supported, In-development, Partial, or Routing-only. The tier reflects how confidently Consenti tracks that regulation's ongoing legal changes, not just whether the code exists. The Maintained and Supported regulations are re-checked every quarter (see how Consenti aims to stay compliant); the most recent review ran on 8 October 2026 (2026 Q4).

Regulation → tier

Every country not individually named above still resolves to a sensible compliance group via the map below — that's the Routing-only tier in practice: UX-template routing (opt-in / opt-out / notice-only behaviour) without per-country legal maintenance.

Compliance Groups

1. Standard Opt-in (GDPR) — opt-in

   GDPR / ePrivacy style: prior consent required before non-essential cookies. Granular consent, easy reject, easy withdrawal.

2. Opt-out (US State Laws) — opt-out

   US state privacy laws. Collect first, allow opt-out of sale/share. Covers CCPA and all state-level equivalents.

3. Opt-out Strict (CPRA / California) — opt-out-strict

   California CPRA: opt-out with sale/sharing/sensitive categories required. GPC must be honored. Stricter than general US state laws.

4. Opt-in (India DPDPA) — opt-in-dpdpa

   India's Digital Personal Data Protection Act. Opt-in consent with data fiduciary disclosure. No legitimate interest basis.

5. Opt-in (China PIPL / DSL) — opt-in-china

   China PIPL + DSL + CSL: strict opt-in with purpose specification, data minimisation, and cross-border transfer controls.

6. Opt-in (Brazil LGPD) — opt-in-brazil

   Brazil LGPD: opt-in consent required. Legitimate interest is a valid basis. Analytics and advertising may differ in treatment.

7. General Privacy Consent — general-privacy-consent

   Privacy notice or consent rules exist but the jurisdiction does not have a GDPR/PECR-style strict cookie banner law. Documenting legal basis is best practice.

8. Notice Only — notice-only

   A privacy notice is generally sufficient. No dedicated cookie banner law is encoded for this jurisdiction.

9. Custom compliance groups

   The 8 groups above cover every country in the map, but a profile is not limited to them. Every profile has an optional customComplianceGroup field — a free-form, lower-kebab-case string that stands in for complianceGroup when a site needs a Compliance Group that doesn't map to any built-in group (a bespoke internal policy, a jurisdiction not yet in the map, an A/B test variant, etc.).

   Aspect	Behaviour
   Where it's set	Admin dashboard profile wizard, Step 1 — choose None / Custom instead of one of the 8 built-in radio options, then type the identifier. See the Admin Dashboard guide.
   How it's targeted	Set the widget's compliance.type to the same string. Consenti resolves it exactly like a built-in group, fetching whichever profile is active for that name.
   Requirement	API mode only (api.enabled: true). There is no pre-built/offline fallback for a custom group name — resolution throws if nothing is active for it server-side.
   Validation	None of the COMPLIANCE_VALIDATION_RULES (legal-basis requirements, GPC recommendations, CPRA categories) apply to a custom group — you own correctness.

   💡A related but distinct mechanism: instead of a new custom group, you can also override one of the 8 built-in groups everywhere it's resolved — geo-detected or fixed — by registering a ConsentiProfile with a matching complianceGroup (optionally deepMerge: true to patch instead of replace). See Overriding a built-in compliance group.

Jurisdiction Coverage Map

Click a column header to sort. The United Kingdom is listed as UK; geo providers and browser locales report it as ISO GB, and Consenti treats the two as the same country (in this map and in any complianceMap you supply).

Regional overrides

Some countries route sub-nationally instead of by country alone — most notably the United States (state-level laws) and Canada (Quebec's Law 25). When a resolver returns a region, Consenti checks this table before falling back to the country's base group above.

Supported locales

188 locale codes appear across the map above (BCP 47, e.g. fr-CA, zh-CN). A profile's translations map can use any of these — or any locale at all; the map only reflects what each country typically needs. Resolution order at runtime: exact locale match → language prefix → defaultLocale.